MEXC Reimburses $340K Loss After Forgotten API Key Enables Account Drain

Points of Focus

• MEXC said an attacker used a leftover API key to drain about $340,000.
• CEO Vugar Usi said the user was fully reimbursed as the probe continues.
• MEXC hasn’t explained why the attacker-created API key survived the account recovery.

MEXC has fully compensated a user who lost about $340,000 after an attacker-created API key remained on the account through an earlier account recovery process, according to CEO Vugar Usi.

Usi said in an X post on Sept. 28 that MEXC detected the compromise, froze the account, and helped the user restore access. An API key left on the account later allowed the attacker to transfer funds before the issue was contained. Usi said the investigation into how the failure occurred is continuing.

We recently had a user whose account was compromised.

Our customer service team identified the situation quickly and froze the account. We then worked with the user to restore their original email and authenticator, helping secure the account and prevent further risk.…

— Vugar Usi (@usithetalk) September 28, 2026

MEXC confirms API key enabled $340,000 drain

The affected user, posting as Shuang Fei, said 322,110 USDt (USDT) and 9,133,999 Harmony (ONE) were withdrawn between 04:12 and 04:25 Beijing time on Sept. 27. The six withdrawals began 27 minutes after a 24-hour security hold expired.

In a thread, the user said an attacker had previously changed the account email, password, and authenticator settings. MEXC later identified the issue, froze the account, and restored the original email. The user then reset the password and added a new authenticator but said an API key created while the attacker controlled the account was never removed.

Usi’s statement confirms that the API key was used to transfer the funds. MEXC support had earlier told the user it couldn’t determine from withdrawal records whether the transfers came through the app, website, or API.

API withdrawal rules raise account recovery questions

MEXC’s withdrawal policy says API withdrawals don’t use an address whitelist by default. An API key with withdrawal permission can send funds to any address unless the whitelist is enabled.

MEXC’s Learn guide says freezing an account makes all associated API keys invalid. The guide describes a user-initiated account freeze, while MEXC hasn’t said whether the risk-control freeze applied in this case follows the same process.

MEXC has also not explained why the attacker-created key remained usable after the recovery process or addressed the user’s claim that its creation didn’t appear in the security history visible to him.